Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

3,631 results · page 68 of 73

Oct 7, 2019The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parametCVE-2015-9455 · WordPress plugins & themes · reported by MITREHigh 8.1
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Product
buddypress-activity-plus
Fixed in
1.6.2
What to do
Update buddypress-activity-plus to 1.6.2 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.CVE-2015-9447 · WordPress plugins & themes · reported by MITREMedium 6.5
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.CVE-2015-9445 · WordPress plugins & themes · reported by MITREHigh 8.8
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Product
unite-gallery-lite
Fixed in
1.5
What to do
Update unite-gallery-lite to 1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.CVE-2015-9443 · WordPress plugins & themes · reported by MITREMedium 6.5
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Affected
1.2 to 1.2
What to do
Affects 1.2 to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.CVE-2015-9442 · WordPress plugins & themes · reported by MITREMedium 6.5
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.CVE-2015-9441 · WordPress plugins & themes · reported by MITREMedium 6.5
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Affected
2.9.2 to 2.9.2
What to do
Affects 2.9.2 to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 26, 2019The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.CVE-2015-9440 · WordPress plugins & themes · reported by MITREMedium 6.5
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Product
monetize
Affected
up to 1.03
What to do
Affects up to 1.03. Update monetize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.CVE-2015-9439 · WordPress plugins & themes · reported by MITREMedium 4.8
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Product
addthis
Fixed in
5.0.13
What to do
Update addthis to 5.0.13 or newer.
Full record and what to do →NVD record blog.cinu.pl wordpress.org
Sep 25, 2019The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.CVE-2015-9437 · WordPress plugins & themes · reported by MITREMedium 6.5
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Product
dynamic-widgets
Fixed in
1.5.11
What to do
Update dynamic-widgets to 1.5.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Product
kiwi-logo-carousel
Fixed in
1.7.2
What to do
Update kiwi-logo-carousel to 1.7.2 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc.CVE-2015-9433 · WordPress plugins & themes · reported by MITREMedium 6.5
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
Product
wp-social-bookmarking-light
Fixed in
1.7.10
What to do
Update wp-social-bookmarking-light to 1.7.10 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-CVE-2015-9432 · WordPress plugins & themes · reported by MITREMedium 6.5
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Product
alpine-photo-tile-for-instagram
Fixed in
1.2.7.6
What to do
Update alpine-photo-tile-for-instagram to 1.2.7.6 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_CVE-2015-9431 · WordPress plugins & themes · reported by MITREMedium 6.5
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Product
qtranslate-x
Fixed in
3.4.4
What to do
Update qtranslate-x to 3.4.4 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameCVE-2015-9429 · WordPress plugins & themes · reported by MITREMedium 6.5
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Product
yith-maintenance-mode
Fixed in
1.2.0
What to do
Update yith-maintenance-mode to 1.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone,CVE-2015-9428 · WordPress plugins & themes · reported by MITREMedium 6.5
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Product
wplegalpages
Fixed in
1.1
What to do
Update wplegalpages to 1.1 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.CVE-2015-9427 · WordPress plugins & themes · reported by MITREMedium 6.5
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Product
googmonify
Affected
up to 0.5.1
What to do
Affects up to 0.5.1. Update googmonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.CVE-2015-9426 · WordPress plugins & themes · reported by MITREMedium 4.6
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Product
manual-image-crop
Fixed in
1.11
What to do
Update manual-image-crop to 1.11 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admiCVE-2015-9424 · WordPress plugins & themes · reported by MITREMedium 6.5
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Product
multicons
Fixed in
3.0
What to do
Update multicons to 3.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_diaCVE-2015-9422 · WordPress plugins & themes · reported by MITREMedium 6.5
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Product
PlugNedit Adaptive Editor
Fixed in
6.2.0
What to do
Update PlugNedit Adaptive Editor to 6.2.0 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.CVE-2015-9421 · WordPress plugins & themes · reported by MITREMedium 6.5
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Product
olevmedia-shortcodes
Fixed in
1.1.9
What to do
Update olevmedia-shortcodes to 1.1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Sep 25, 2019The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.CVE-2015-9418 · WordPress plugins & themes · reported by MITREMedium 4.3
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Product
Watu Pro
Fixed in
4.9.0.8
What to do
Update Watu Pro to 4.9.0.8 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 25, 2019The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.CVE-2015-9417 · WordPress plugins & themes · reported by MITREMedium 6.5
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
Product
testimonial-slider
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update testimonial-slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 25, 2019The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.CVE-2015-9413 · WordPress plugins & themes · reported by MITREMedium 6.5
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Product
eshop
Affected
up to 6.3.13
What to do
Affects up to 6.3.13. Update eshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 25, 2019The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.CVE-2015-9409 · WordPress plugins & themes · reported by MITREMedium 6.5
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Product
alo-easymail
Fixed in
2.6.01
What to do
Update alo-easymail to 2.6.01 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.CVE-2015-9408 · WordPress plugins & themes · reported by MITREMedium 6.5
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Product
xpinner-lite
Affected
up to 2.2
What to do
Affects up to 2.2. Update xpinner-lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.CVE-2015-9394 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Product
users-ultra
Fixed in
1.5.63
What to do
Update users-ultra to 1.5.63 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 20, 2019The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.CVE-2016-10997 · WordPress plugins & themes · reported by MITREMedium 6.5
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
Affected
1.0.8 to 1.0.8
What to do
Affects 1.0.8 to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com exploit-db.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.CVE-2015-9388 · WordPress plugins & themes · reported by MITREMedium 6.5
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 20, 2019The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.CVE-2015-9387 · WordPress plugins & themes · reported by MITREMedium 6.5
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
Product
mtouch-quiz
Fixed in
3.1.3
What to do
Update mtouch-quiz to 3.1.3 or newer.
Full record and what to do →NVD record wordpress.org davidsopas.com
Sep 17, 2019The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.CVE-2016-10989 · WordPress plugins & themes · reported by MITREHigh 8.8
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
Product
leenkme
Fixed in
2.6.0
What to do
Update leenkme to 2.6.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.CVE-2016-10982 · WordPress plugins & themes · reported by MITREHigh 8.8
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
Product
kento-post-view-counter
Affected
up to 2.8
What to do
Affects up to 2.8. Update kento-post-view-counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org openwall.com
Sep 17, 2019The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.CVE-2016-10978 · WordPress plugins & themes · reported by MITREHigh 8.8
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
Product
fossura-tag-miner
Fixed in
1.1.5
What to do
Update fossura-tag-miner to 1.1.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 17, 2019The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.CVE-2016-10974 · WordPress plugins & themes · reported by MITREHigh 8.8
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
Product
fluid-responsive-slideshow
Fixed in
2.2.7
What to do
Update fluid-responsive-slideshow to 2.2.7 or newer.
Full record and what to do →NVD record klikki.fi wordpress.org
Sep 16, 2019The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.CVE-2016-10962 · WordPress plugins & themes · reported by MITREMedium 6.5
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
Product
icegram
Fixed in
1.9.19
What to do
Update icegram to 1.9.19 or newer.
Full record and what to do →NVD record sumofpwn.nl wordpress.org
Sep 16, 2019The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.CVE-2016-10959 · WordPress plugins & themes · reported by MITREMedium 6.5
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Product
estatik
Fixed in
2.3.1
What to do
Update estatik to 2.3.1 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Sep 13, 2019The wp-d3 plugin before 2.4.1 for WordPress has CSRF.CVE-2016-10946 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
Product
wp-d3
Fixed in
2.4.1
What to do
Update wp-d3 to 2.4.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 13, 2019The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.CVE-2016-10945 · WordPress plugins & themes · reported by MITREHigh 8.8
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record klikki.fi wpvulndb.com
Sep 13, 2019The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.CVE-2016-10944 · WordPress plugins & themes · reported by MITREHigh 8.8
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Product
multisite-post-duplicator
Fixed in
1.1.3
What to do
Update multisite-post-duplicator to 1.1.3 or newer.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.CVE-2016-10942 · WordPress plugins & themes · reported by MITRECritical 9.8
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.CVE-2016-10941 · WordPress plugins & themes · reported by MITREMedium 6.1
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Product
podlove-podcasting-plugin-for-wordpress
Fixed in
2.3.16
What to do
Update podlove-podcasting-plugin-for-wordpress to 2.3.16 or newer.
Full record and what to do →NVD record blog.ripstech.com github.com
Sep 13, 2019The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.CVE-2016-10938 · WordPress plugins & themes · reported by MITREMedium 6.5
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisories.dxw.com wordpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
Affected
up to 4.4
What to do
Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp jvn.jp
Sep 10, 2019The avada theme before 5.1.5 for WordPress has CSRF.CVE-2017-18607 · WordPress plugins & themes · reported by MITREHigh 8.8
The avada theme before 5.1.5 for WordPress has CSRF.
Product
avada
Fixed in
5.1.5
What to do
Update avada to 5.1.5 or newer.
Full record and what to do →NVD record wpvulndb.com wpvulndb.com
Sep 3, 2019The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-15868 · WordPress plugins & themes · reported by MITREHigh 8.8
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
Product
affiliates-manager
Fixed in
2.6.6
What to do
Update affiliates-manager to 2.6.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Sep 3, 2019The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15865 · WordPress plugins & themes · reported by MITREHigh 8.8
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
Product
breadcrumbs-by-menu
Fixed in
1.0.3
What to do
Update breadcrumbs-by-menu to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_viCVE-2019-15841 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
Product
facebook-for-woocommerce
Fixed in
1.9.15
What to do
Update facebook-for-woocommerce to 1.9.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.CVE-2019-15840 · WordPress plugins & themes · reported by MITREHigh 8.8
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
Product
facebook-for-woocommerce
Fixed in
1.9.14
What to do
Update facebook-for-woocommerce to 1.9.14 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 30, 2019The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.CVE-2019-15835 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
Product
wp-better-permalinks
Fixed in
3.0.5
What to do
Update wp-better-permalinks to 3.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 30, 2019The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.CVE-2019-15834 · WordPress plugins & themes · reported by MITREHigh 8.8
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
Product
webp-converter-for-media
Fixed in
1.0.3
What to do
Update webp-converter-for-media to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.